refactor: enforce password min-length via domain Password value object

crates/application/src/auth/register.rs

@@ -1,24 +1,17 @@
 use domain::{
     errors::DomainError,
     models::User,
-    value_objects::{Email, Username},
+    value_objects::{Email, Password, Username},
 };
 
 use crate::{auth::commands::RegisterCommand, context::AppContext};
 
-const MIN_PASSWORD_LENGTH: usize = 8;
-
 pub async fn execute(ctx: &AppContext, cmd: RegisterCommand) -> Result<(), DomainError> {
     if !ctx.config.allow_registration {
         return Err(DomainError::Unauthorized("Registration is disabled".into()));
     }
 
-    if cmd.password.len() < MIN_PASSWORD_LENGTH {
-        return Err(DomainError::ValidationError(
-            "Password must be at least 8 characters".into(),
-        ));
-    }
-
+    let password = Password::new(cmd.password)?;
     let email = Email::new(cmd.email)?;
     let username = Username::new(cmd.username)?;
 
@@ -34,7 +27,7 @@ pub async fn execute(ctx: &AppContext, cmd: RegisterCommand) -> Result<(), Domai
         ));
     }
 
-    let hash = ctx.services.password_hasher.hash(&cmd.password).await?;
+    let hash = ctx.services.password_hasher.hash(password.value()).await?;
     ctx.repos
         .user
         .save(&User::new(email, username, hash, cmd.role))

crates/application/src/auth/tests/register.rs

@@ -46,3 +46,19 @@ async fn test_register_duplicate_email_fails() {
     let result = register::execute(&ctx, cmd("bob@example.com")).await;
     assert!(result.is_err(), "duplicate email should fail");
 }
+
+#[tokio::test]
+async fn test_register_short_password_fails() {
+    let ctx = TestContextBuilder::new().build();
+    let result = register::execute(
+        &ctx,
+        RegisterCommand {
+            email: "x@y.com".to_string(),
+            username: "testuser".to_string(),
+            password: "short".to_string(),
+            role: UserRole::Standard,
+        },
+    )
+    .await;
+    assert!(result.is_err());
+}